mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekay
3b37aa2e7a
Red proved H3's VerifyUnderPolicy was INERT: the live wire-level verifier
(QuantumPolicy.VerifyWithKeys -> QuasarCert.VerifyWithRealKeys) used the
implied-policy path (BLS-permissive), and the policy-driven path had ZERO
live callers. consensus/engine/pq (PostQuantum.SetCertPolicy) was dead —
nothing imported it.
Task 3 — make the LIVE path policy-driven from the SINGLE source of truth:
- config: ChainSecurityProfile.CertPolicy() — the one mapping from the
chain's security profile to its cert posture. strict-PQ/FIPS -> Strict
variant (BLS NOT a required leg) + Mode=PQ-strict (RequiredLegs =
{Pulsar, Corona}); other profiles -> Hybrid (BLS retained alongside PQ).
- pkg/wire: QuantumPolicy carries that CertPolicy. New VerifyCertUnderPolicy
is THE live verifier — routes through QuasarCert.VerifyUnderPolicy with
the chain's policy + full CertKeys. VerifyWithKeys is now a thin adapter
over it. NewQuantumPolicyForProfile derives the policy from the profile.
Leg presence is policy-driven (VerifyUnderPolicy Gate 1), never
cert-byte-driven: a CRQC that forges BLS and strips the PQ legs is
rejected.
- Deleted consensus/engine/pq (10 files, zero importers — the whole package
was dead, not just SetCertPolicy). The live verify is now the wire path.
Test (d): on a strict-PQ chain, the LIVE verifier rejects a BLS-only
(PQ-legs-stripped) cert even with a valid BLS key supplied; the policy is
Strict-variant (BLS not required, Corona required); the permissive default
is Hybrid (BLS required) — proving the switch is profile-driven, not
hardcoded. (The per-leg crypto half is covered in quasar/
cert_policy_verify_test.go.)